Wordpress how to prevent downloads by direct URL?

So I have a site, and let's say a zip file is sent in a private message. I go to the attachment page, I get the page's URL, I run it in the browser.

https://site.com/private_message/something-something/other-other-zip/
And when I open it in a browser, whether I'm logged in or not, I'm prompted to download the zip file. That's not cool

My sitemap does not include the attachment/media pages. And the URLs are not that simple. Still, I have a feeling I should prevent this from being possible.

Any tips on this topic?

Scorpion Ghost said:

So I have a site, and let's say a zip file is sent in a private message. I go to the attachment page, I get the page's URL, I run it in the browser.

https://site.com/private_message/something-something/other-other-zip/
And when I open it in a browser, whether I'm logged in or not, I'm prompted to download the zip file. That's not cool

My sitemap does not include the attachment/media pages. And the URLs are not that simple. Still, I have a feeling I should prevent this from being possible.

Any tips on this topic?

Click to expand...

And to add, the same zip file that can be downloaded from the link above, can also be downloaded from this one:

https://site.com/wp-content/uploads/2022/09/something-something/other-other.zip
One is the Attachment Page, and the other is the File URL.

You open either of the links in a browser, doesn't matter if you're logged in or not, and you get prompted to download the file.

Not cool bro...

I tried many things that I found on Google to prevent it from happening, but no luck. Always you get the download. I may have to go with a plugin for this one, I don't know...

Tagging the higher powers @TomTheCat @BlogPro

So I put this code in htaccess file:


And it works, but this totally prevents .zip downloads, even for logged in users that I sent them a zip file. These users should be allowed to download.

Anyone knows if this can be changed to apply only for users that are logged out?

Okay, so I tried, I really did. The closest I got to something that sort of works, is creating a dl-file.php file in root of my site, and putting this in it:

I tried posting code, but BHW often just throws an error. It's PHP code, I wrapped it in PHP tags, but the forum won't let me post and I don't know why. The code is at the top of this page - https://gist.github.com/hakre/1552239

And then this in htaccess:


And this sort of worked, but then trying it on various browsers, sometimes I could still get to download the zip file. These are browsers that have never been logged into the site, or any site.

And then I tried logged in, and I'm allowed to download one zip file, but I get redirected to the homepage when I try to download another.

---

Anyway, even if I got this to work, it would still only work for users that are not logged in. But registering on the site takes less than a minute. So it's only protection against really really lazy people.

I tried google, I got no replies here, I tried plugins, can't get this one done. All I wanted is for people that receive a zip file on the order page or private messages within the site to be able to download them, and anyone else not to be allowed to.

I'm pretty sure that there is no way for someone to navigate my site and find the download links somehow. My sitemap doesn't show them. And since I categorize uploads into dates on the site, someone would really need to get the year and the month and the exact filename and extension, to be able to download something. I guess, if someone is slick enough to do it, they beat the weak protection, and let them have it. What can I do...

Enough time wasted on this. Some things you either let go or pay someone to do for you. We're gonna let go of this one.

Stupid ass wordpress